DETECTING COMPROMISED BALLOTS 


ABSTRACT OF THE DISCLOSURE 


A facility for transmitting a ballot choice selected by a voter is described. The 
facility encrypts the ballot choice with a first secret known only to the client to generate a 
first encrypted ballot component. The facility also encrypts the ballot choice with a second 
secret known only to the client, the second secret chosen independently of the first secret, 
to generate a second encrypted ballot component. The facility then generates a proof 
demonstrating that the first and second encrypted ballot components are encrypted from the 
same ballot choice. The facility sends the first and second encrypted ballot components and 
the proof to a vote collection computer system. 
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